DS-KH8501-A hikvision indoor station china lang

mitrich161616

mitrich161616

n3wb
Oct 26, 2018
8
1
russia
Good day. There is a monitor intercom with Chinese language DS-KH8501-A. The serial number belongs to the Chinese location. When trying to download a Europian firmware in Batch configurator swears at a language mismatch. When I change the language zone in the firmware file from 1 to 2 in hiktools05R1, the firmware is loaded, but the interface is obtained with a broken encoding. SSH, Telnet not connected from this device.
As I understand, there is only one way out - soldering the SPI chip and taking a dump on the programmer. How can you find the serial number of the device in the dump and change it from Chinese to European location? Help me please...The firmware file is attached just in case, how can I fix it and get a normal language? Dump flash memory has not yet done.
IMG_20181026_004743.jpg IMG_20181027_204445.jpg
 

Attachments

Last edited:
Today I soldered the memory chip and dumped it on the programmer.
How can find the serial number in the dump and change the location to an international one?
Dump has attached!
2018-Oct-29 20:26:16: Welcome to DediProg SF6.0.5.19
2018-Oct-29 20:26:16: Start logging ...
2018-Oct-29 20:26:16: Checking Windows version ....
2018-Oct-29 20:26:16: Windows version: Windows 10
2018-Oct-29 20:26:16: Checking USB connnection ....
2018-Oct-29 20:26:16: USB OK.
2018-Oct-29 20:26:18: Detecting Chip ....
2018-Oct-29 20:26:23: Current Type: W25Q128JV
2018-Oct-29 20:26:23: VCC 3.5V is applied.
2018-Oct-29 20:26:55: Single IO is set.
2018-Oct-29 20:26:55: Reading a whole memory of 0x1000000 bytes...
2018-Oct-29 20:27:07: Finish reading a whole memory
2018-Oct-29 20:27:07: Operation completed.
2018-Oct-29 20:27:07: 12.809 seconds elapsed.
2018-Oct-29 20:31:16: Loading C:\Users\MitricH\Desktop\dumps\ds-kh8501-a_my_work\ds-kh8501-a_my_work.bin ...
2018-Oct-29 20:31:16: C:\Users\MitricH\Desktop\dumps\ds-kh8501-a_my_work\ds-kh8501-a_my_work.bin Loaded.
2018-Oct-29 20:31:16: Operation completed.
2018-Oct-29 20:31:16: 0.312 seconds elapsed.
2018-Oct-29 20:33:26: Single IO is set.
2018-Oct-29 20:33:26: Programming parameters:
2018-Oct-29 20:33:26: Source File: ds-kh8501-a_my_work.bin(0x1000000 bytes)
2018-Oct-29 20:33:26: ATE Region: [0, 0x1000000)
2018-Oct-29 20:33:26: Spare Memory Region: leave as being erased.
2018-Oct-29 20:33:26: Truncate-File-To-Fit-Memory Enabled.
2018-Oct-29 20:33:27: Reading From Address [0, 0x1000000) ...
2018-Oct-29 20:33:39: Finished reading from memory.
2018-Oct-29 20:33:39: Checksum Identical:
2018-Oct-29 20:33:39: Original File checksum(0x1000000 bytes)(CRC-32):2ece1eb5
2018-Oct-29 20:33:39: Downloaded bytes checksum(0x1000000 bytes)(CRC-32):2ece1eb5
2018-Oct-29 20:33:39: Chip checksum([0, 0x1000000) of total 0x1000000 bytes(chip size))(CRC-32): 2ece1eb5
2018-Oct-29 20:33:39: The downloaded checksum could be different from that of the original file if it's downloaded partially.
2018-Oct-29 20:33:39: Operation completed.
2018-Oct-29 20:33:39: 14.756 seconds elapsed.
 

Attachments

Last edited:
I connect my device to TTL.
Log:
HKVS # help
? - alias for 'help'
base - print or set address offset
bootm - boot application image from memory
bootp - boot image via network using BOOTP/TFTP protocol
bubt - Burn an boot image on the Boot Flash.

cmp - memory compare
cp - memory copy
cpld - write cpld info to encrypt media

cramfsload- cramfsload - load binary file from a filesystem image
cramfsls- cramfsls - list files in a directory (default /)
crc32 - checksum calculation
erase_env- erase envirement info on flash

getinfo - print hardware information
go - start application at address 'addr'
help - print command description/usage
loadb - load binary file over serial line (kermit mode)
loady - load binary file over serial line (ymodem mode)
loop - infinite loop on address range
md - memory display
mii - MII utility commands
mm - memory modify (auto-incrementing address)
mtest - simple RAM read/write test
mw - memory write (fill)
nm - memory modify (constant address)
ping - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
rarpboot- boot image via network using RARP/TFTP protocol
reset - Perform RESET of the CPU
run - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv - set environment variables
sf - SPI flash sub-system
tftp - tftp - download or upload image via network using TFTP protocol
update - Update the digicap of the device.

version - print monitor version
HKVS # update
MAC: 58-03-FB-B3-85-8A
TFTP from server 192.0.0.128; our IP address is 192.0.0.64
Download Filename 'digicap.dav'.
Download to address: 0x80800000
Downloading: *# [ Connected ]
################################ [ 1.000 MB]
################################ [ 2.000 MB]
################################ [ 3.000 MB]
################################ [ 4.000 MB]
################################ [ 5.000 MB]
################################ [ 6.000 MB]
################################ [ 7.000 MB]
################################ [ 8.000 MB]
################################ [ 9.000 MB]
################################ [10.000 MB]
################################ [11.000 MB]
################################ [12.000 MB]
################################ [13.000 MB]
################################ [14.000 MB]
#
done
Bytes transferred = 14737532 (e0e07c hex)
cramfs.img checkSum ok !
Erasing SPI flash...done
Writing SPI flash...done
Upgrade check ......done
Erasing devcfg...done
HKVS # reset
resetting ...
u-Boot 2010.06 (May 13 2015 - 14:30:10)

Hit any key to stop autoboot: 1 0
### CRAMFS load complete: 2161840 bytes loaded to 0x80400000
### CRAMFS load complete: 1185719 bytes loaded to 0x80800000
timeout for link [5000]!
MAC: 58-03-FB-B3-85-8A
|RCV UDP pack timeout| TFTP server not found
## Booting kernel from Legacy Image at 80400000 ...
## Loading init Ramdisk from Legacy Image at 80800000 ...
Loading Kernel Image ... OK
OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.

init started: BusyBox v1.16.1 (2015-05-13 17:16:51 CST)
Mon Apr 4 17:36:36 UTC 2011
Starting udev: [ OK ]
show logo Mon Apr 4 17:36:36 UTC 2011
VGA LineBytes is 4096 ImgWidth is 1024 ImgHeight is 600
funcret1 = 3
CVBS LineBytes is 2880 ImgWidth is 717 ImgHeight is 576
start decompress Mon Apr 4 17:36:37 UTC 2011
end decompress Mon Apr 4 17:36:54 UTC 2011
scriptCmd: ./load3520A -i TW2964.
insmod: can't insert 'extdrv/ssp.ko': invalid module format


BusyBox v1.16.1 (2015-05-13 17:16:51 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

pdev_hard_info->alarmInNums=8
pdev_hard_info->alarmOutNums=2
pdev_hard_info->dspNums=1
pdev_hard_info->encodeChans=1
pdev_hard_info->decodeChans=1
pdev_hard_info->ipcChans=0
pdev_hard_info->ivsChans=0
pdev_hard_info->flashSize=0x10
pdev_hard_info->ramSize=0x100
pdev_hard_info->networkNums=2
pdev_hard_info->ataCtrlNums=0
pdev_hard_info->panelVersion=0
audio_input_nun=1
board=62976(0xf600)
cpldіМРт°ж±ѕ: 21Дк5ФВ18ИХ
PCB:DS-17011
УІјю°ж±ѕєЕ:f600
**************************************************
Working Copy Path: /usr/local/jenkins/workspace/Alarm-VIS-Branch-Package/PJ01C20161114136_дї„зЅ—ж–ЇZAO可视对讲1.4.7дї„иЇж— 楼层定制


BusyBox v1.16.1 (2015-05-13 17:16:51 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

[32m[guest[0m@[31mdvrdvs[0m [32m/] [35m$ [0mURL: https://192.0.0.183/IBP/VIS/branches/Custom/PJ01C20161114136_俄罗斯ZAO可视对讲1.4.7俄语无楼层定制/APPS
Last Change Rev: 44470
Last Change Date: 2016-12-21 16:33:08 +0800 (дё‰, 2016-12-21)
Program Provide: ci
Program Build Time: 2016-12-21 16:52:29
**************************************************
>>>open /dev/msb1 error: errno = 2(No such file or directory)
>>>open /dev/msb error: errno = 2(No such file or directory)
>>>open /dev/msa1 error: errno = 2(No such file or directory)
>>>open /dev/msa error: errno = 123(No medium found)
[ERR][../../../net/netUtil/net_util.c #980]: eth0 mac address is: 58:03:fb:b3:85:8a
normal panel found.
[ERR][../../../system/param/paramLib.c #3127]: Can't open parameter file on flash, errno=0x2.
[ERR][storage/hdCtrl/stor_adaptation_layer.c #2471]: stor_update_quota_param chan(-6) error.
[ERR][storage/hdCtrl/stor_adaptation_layer.c #2471]: stor_update_quota_param chan(-5) error.
[ERR][storage/hdCtrl/stor_adaptation_layer.c #2471]: stor_update_quota_param chan(-4) error.
[ERR][storage/hdCtrl/stor_adaptation_layer.c #2471]: stor_update_quota_param chan(-3) error.
[ERR][storage/hdCtrl/stor_adaptation_layer.c #2471]: stor_update_quota_param chan(-2) error.
[ERR][storage/hdCtrl/stor_adaptation_layer.c #2471]: stor_update_quota_param chan(-1) error.
[ERR][storage/hdCtrl/stor_adaptation_layer.c #2471]: stor_update_quota_param chan(0) error.
[ERR][../../../dataManagement/database/db.c #102]: sqlite3_exec fail: 1(no such table: ring_info)!

======>sql: [delete from ring_info ;]

read decNoSignle file n=101376
read calling image file n=460800
getMaxIPCCount 0

[0;35m*****************************************************
[0;35m** **
[0;35m** MODULE : DSP snv_37017
[0;35m** BUILD TIME : Sep 27 2016 15:46:27
[0;35m** INITPRM SIZE : 1316960 Bytes
[0;35m** **
[0;35m*****************************************************

[0;32m[DSP] >>>> DSP_SetParam(pDspInitPara,pFunc) ...
[m[0;32m[DSP] <<<< DSP_SetParam(pDspInitPara,pFunc) Done! ret 0x0
[m[0;32m[DSP] >>>> DSP_SetStatus() ...
[m[0;32m[DSP] <<<< DSP_SetStatus() Done! ret 0x0
[m[0;32m[DSP] >>>> DSP_Secret() ...
[m[0;32m[DSP] <<<< DSP_Secret() Done! ret 0x0
[m[0;32m[DSP] >>>> InitDateTime() ...
[m[0;32m[DSP] <<<< InitDateTime() Done! ret 0x0
[m[0;32m[DSP] >>>> InitSys() ...
[m[0;35m[DSP] HI_VERSION=Hi3520A_MPP_V1.0.8.1
[m[0;32m[DSP] POOL ID:0, u32BlkSize=460800, u32BlkCnt=8
[m[0;32m[DSP] POOL ID:1, u32BlkSize=152064, u32BlkCnt=8
[m[0;32m[DSP] POOL ID:2, u32BlkSize=784, u32BlkCnt=8
[m[0;32m[DSP] POOL ID:3, u32BlkSize=1382400, u32BlkCnt=2
[m[0;32m[DSP] POOL ID:4, u32BlkSize=0, u32BlkCnt=0
[m[0;32m[DSP] <<<< InitSys() Done! ret 0x0
[m[0;32m[DSP] >>>> InitModuleChanManger() ...
[m[0;32m[DSP] <<<< InitModuleChanManger() Done! ret 0x0
[m[0;32m[DSP] >>>> InitCmd() ...
[m[0;32m[DSP] <<<< InitCmd() Done! ret 0x0
[m[0;32m[DSP] >>>> InitStaticImg() ...
[m[0;32m[DSP] callpic set OK!
[m[0;32m[DSP] <<<< InitStaticImg() Done! ret 0x0
[m[0;32m[DSP] >>>> InitStreamPack() ...
[m[0;32m[DSP] <<<< InitStreamPack() Done! ret 0x0
[m[0;32m[DSP] >>>> InitStreamPool() ...
[m[0;32m[DSP] <<<< InitStreamPool() Done! ret 0x0
[m[0;32m[DSP] >>>> InitVi() ...
[m[0;32m[DSP] <<<< InitVi() Done! ret 0x0
[m[0;32m[DSP] >>>> InitVo() ...
[m[1;33m[DSP] vo.c|VoLayerBind|443: Layer 0, return
[m[1;33m[DSP] vo.c|VoLayerBind|443: Layer 2, return
[m[0;32m[DSP] <<<< InitVo() Done! ret 0x0
[m[0;32m[DSP] >>>> InitAudio() ...
[m[0;32m[DSP] himpi_CreateAi AudioDevId 2
[m[0;32m[DSP] AI_ATTR_S enSamplerate 8000, enBitwidth 1, enWorkmode 1, enSoundmode 0,u32EXFlag 1, u32FrmNum 30, u32PtNumPerFrm 320, u32ChnCnt 2, u32ClkSel 1
[m[0;32m[DSP] himpi_CreateAo AudioDevId 2
[m[0;32m[DSP] AO_ATTR_S enSamplerate 8000, enBitwidth 1, enWorkmode 1, enSoundmode 0,u32EXFlag 1, u32FrmNum 9, u32PtNumPerFrm 320, u32ChnCnt 2, u32ClkSel 1
[m[1;33m[DSP] WARN: HDMI disable
[mpageaddr:4013f000,dgbaddr:4013f000,size:0
[0;32m[DSP] <<<< InitAudio() Done! ret 0x0
[m[0;32m[DSP] >>>> InitDecoder() ...
[m[1;33m[DSP] WARN: InitDecoder chan 0, malloc memory form arm orgBufLen 0x100000
[m[0;32m[DSP] <<<< InitDecoder() Done! ret 0x0
[m[0;32m[DSP] >>>> InitGrahpics() ...
[m[0;32m[DSP] <<<< InitGrahpics() Done! ret 0x0
[m[0;32m[DSP] >>>> InitEncode() ...
[m[0;35m[DSP] AinDev 2, AinChn 0, AencChn 0
[mpageaddr:40141000,dgbaddr:40141000,size:0
[0;32m[DSP] <<<< InitEncode() Done! ret 0x0
[m[0;32m[DSP] >>>> InitOsd() ...
[m[0;32m[DSP] <<<< InitOsd() Done! ret 0x0
[m[0;32m[DSP] >>>> InitVProc() ...
[m[0;32m[DSP] <<<< InitVProc() Done! ret 0x0
[m[0;32m[DSP] >>>> InitJpegSoft() ...
[m[0;32m[DSP] <<<< InitJpegSoft() Done! ret 0x0
[m[0;32m[DSP] >>>> InitAes() ...
[m[0;32m[DSP] <<<< InitAes() Done! ret 0x0
[m[0;32m[DSP] >>>> InitLowPower() ...
[m[0;32m[DSP] <<<< InitLowPower() Done! ret 0x0
[m[0;32m[DSP] total alloc 6768976
[m[1;33m[DSP] dec.c|TskDecDownloadStream|590: LOAD = 0, tid=803, pid=784
[m[0;35m[DSP] TskAudioDisplay LOAD, tid=799, pid=784
[m[1;33m[DSP] WARN: TskAudTalkBack LOAD = 0, tid=802, pid=784
[m[0;32m[DSP] InitDsp OK!!!
[m[0;32m[DSP] DSP (SvnVersion:37017) Build Time: Sep 27 2016:15:46:25
[m[0;32m[DSP] Size 1316960
[m[0;32m[DSP] viResolution =0
[m[0;32m[DSP] bHaveVo =0
[m[0;32m[DSP] viType =7
[m[0;32m[DSP] aiType =8
[m[0;32m[DSP] cpuFreq =0
[m[0;32m[DSP] encChanCnt =1
[m[0;32m[DSP] decChanCnt =1
[m[0;32m[DSP] IpcChanCnt =1
[m[0;32m[DSP] dispChanCnt =3
[m[0;32m[DSP] bHaveMenu =0
[m[0;32m[DSP] menuDispChan =0
[m[0;32m[DSP] bHaveVga =0
[m[0;32m[DSP] dispMode =4
[m[0;32m[DSP] boardType =15
[m[0;32m[DSP] sn =0
[m[0;32m[DSP] machineType =57351
[m[0;32m[DSP] bDetectViSignal =0
[m[0;32m[DSP] voStandard =2
[m[0;32m[DSP] voType =0
[m[0;32m[DSP] device_type =7
[m[0;32m[DSP] device_info =0
[m[0;32m[DSP] bDspStarted =1
[m[0;32m[DSP] bViInited =0
[m[0;32m[DSP] bVoInited =0
[m[0;32m[DSP] logBuf.bufLen =0
[m[0;32m[DSP] streamParam:
[m[0;32m[DSP] videoEncType =5
[m[0;32m[DSP] videoSubEncType =5
[m[0;32m[DSP] strPacketType =5
[m[0;32m[DSP] strSubPacketType =4
[m[0;32m[DSP] bWaterMark =0
[m[0;32m[DSP] streamParam.audioParam:
[m[0;32m[DSP] encType =0
[m[0;32m[DSP] samplesPerSecond =0
[m[0;32m[DSP] samplesPerFrame =0
[m[0;32m[DSP] boardSamplesPerSecond =0
[m[0;32m[DSP] encChans =0
[m[0;32m[DSP] bitRate =0
[m[0;32m[DSP] talkBackType =0
[m[0;32m[DSP] talkBackSamplesPerSecond =0
[m[0;32m[DSP] talkBackSamplesPerFrame =0
[m[0;32m[DSP] boardOutSamplesPerSecond =0
[m[0;32m[DSP] talkBackBitRate =0
[m[0;32m[DSP] talkBackChans =0
[m[0;32m[DSP] boardOutChans =0
[m[0;32m[DSP] audOutVolume =0
[m[0;32m[DSP] mouseParam.X =0
[m[0;32m[DSP] mouseParam.Y =0
[m[0;32m[DSP] mouseParam.I =0
[m[0;32m[DSP] bVgaDisp =1
[m[0;32m[DSP] bVoExchangeOk =0
[m[0;32m[DSP] bResetFpga =0
[m[0;32m[DSP] viSigState =0
[m[0;32m[DSP] bChanUnmatch =0
[m[0;32m[DSP] kyNum =0
[m[0;32m[DSP] device_memsize =0
[m[0;32m[DSP] bOnechnDec =0
[m[0;32m[DSP] maxD1EncChns =0
[m[0;32m[DSP] armNeedBufLen =0
[m[0;32m[DSP] pArmNeedBuf =(null)
[m[0;32m[DSP] NetOsdType =0
[m[0;32m[DSP] dspIdx =0
[m[0;32m[DSP] bSupportZeroEncode=0
[m[0;32m[DSP] chipId =-868586728
[m[0;32m[DSP] malloc Encode Buf:
[m[0;32m[DSP] NetPoolMain[0].totalLen = 512 K
[m[0;32m[DSP] NetPoolMain[0].vAddr = 0x40eca008
[m[0;32m[DSP] NetPoolSub[0].totalLen = 128 K
[m[0;32m[DSP] NetPoolSub[0].vAddr = 0x2f486f0
[m[0;35m[DSP] Total malloc len user 6768976(7) dsp 7481856(8)
[mg_pDspInitPara->viType = 7
[ERR][src/interface/comSubDefine.c #2891]: Read bmp error!! logoPath:/home/app/logo/logo.bmp
iMainIdx 2,iAuxIdx 1
[ERR][event/interactCtrl/osdCtrl.c #520]: seems not init!
[PSWD][0061]:public_base64_len 188 len 140
init_stor_system maxEnChanNo = 1 maxIPCount 0
encParam fps = 0
[1;33m[DSP] encHostCmd.c|HostSetEncoderParam|172: chan 0 videoType 2 resolution 1010
[mencParam fps = 0
[1;33m[DSP] encHostCmd.c|HostSetEncoderParam|172: chan 0 videoType 2 resolution 1010
[m[1;33m[DSP] encHostCmd.c|HostSetSubEncoderParam|242: subChan 32 videoType 2
[m[1;33m[DSP] encHostCmd.c|HostStartEncode|109: chan 0
[m######## w = 1024, h = 600, depth=16
--------end of InitGAL--------
[ERR][../../../net/netUtil/net_config.c #905]: wlan0 get_netmask ioctl error and errno=99
[ERR][../../../net/netUtil/net_config.c #905]: wlan0 get_netmask ioctl error and errno=99
[ERR][../../../net/netUtil/net_config.c #905]: wlan0 get_netmask ioctl error and errno=99
[ERR][transProtocol/transParse.cpp #1812]: getDoorInfoFromDb err
[ERR][protocol/control.cpp #955]: AppKey:bd9731ed82d6413daeecd9841c54a1cc
[CRIT][misc/misc.c #705]: ###### error Ctrl yPos, Ctrl : auto_accept, yPos_desc : auto_acceptt_y######
[1;33m[DSP] encHostCmd.c|HostStopEncode|126: chan 0
[mIAL Native Engine: mouse device has been connected.
=======Init GUI [ [5mOK[0m ]=======
IME: Loading Input Method 0: pinyin
keyboard index error!!, current_board_idx:2,index:2.
keyboard index error!!, current_board_idx:2,index:2.
<dataManagement/storManagement/storManage.c, 156>Param error!
iYoffset[0] = 0
====== del line feed character 1 ======
====== del line feed character 1 ======
====== del line feed character 1 ======
====== del line feed character 1 ======
====== del line feed character 1 ======
keyboard index error!!, current_board_idx:2,index:2.
[ERR][src/gui_localConfigurationApi.c #898]: roomNum is 0
[ERR][../../../net/netUtil/net_config.c #905]: wlan0 get_netmask ioctl error and errno=99
[ERR][../../../net/netUtil/net_config.c #905]: wlan0 get_netmask ioctl error and errno=99



Fonts broken(((((
How to backup MTDblock6 via TFTP from computer?
 
hi sir..the file firmware you posted is it the edited one..from EN to CH?
I also have Chinese version monitor ..same model..I too can't upgrade..I tried hiktools but since I have very less knowledge of CMD I could not edit the firmware
 
good day. I found the same device but with live firmware with a fix for the Chinese version. From my firmware dump, I pulled out the area responsible for the serial numbers and inserted this area into the dump from the live machine. Now my machine is working properly. I also want to be able to update the firmware to a newer version, but have not yet found how to do this.
I made a video of how to dump the firmware from your device through the UART port. As soon as you download the dump, send it to me, I will edit the live firmware by inserting your device serial numbers and send it back to you. But you need to upload the corrected firmware only through the programmer SPI.
 

Attachments

  • vkipiQoVkoQ.jpg
    vkipiQoVkoQ.jpg
    576.9 KB · Views: 36
  • Like
Reactions: Condebart
mitrich161616 said:
good day. I found the same device but with live firmware with a fix for the Chinese version. From my firmware dump, I pulled out the area responsible for the serial numbers and inserted this area into the dump from the live machine. Now my machine is working properly. I also want to be able to update the firmware to a newer version, but have not yet found how to do this.
I made a video of how to dump the firmware from your device through the UART port. As soon as you download the dump, send it to me, I will edit the live firmware by inserting your device serial numbers and send it back to you. But you need to upload the corrected firmware only through the programmer SPI.
Click to expand...



hello, i have the same problem, can you help me? i will buy the usb to ttl in the next monday.

You could send me the UART pinout and the instructions because the video does not look good.
 
You must log in or register to reply here.
Top Bottom